From nobody Fri Jul 24 23:31:01 2026 Received: from cstnet.cn (smtp25.cstnet.cn [159.226.251.25]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 281B03382E1; Wed, 22 Jul 2026 04:43:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.25 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784695440; cv=none; b=dLXCDWpldihxCF2BjpZ9YpyCsEClsPXrmHk17L3nu2QeQO7wKcvBPIuh2ouLhYHJS+k3siA3JKgDi6NuZ3PFw6JYQw6N+hD66uUdh9/bLap5gVRf07ghrfzE41Gb/N2i0TTXOKCMnS5A4Gb+Lq639YJZr8tzsyyHK1PtJzEqSDQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784695440; c=relaxed/simple; bh=y3jh3h7VMBiOe6ULi7kl2yc7ln5h0fcZT/27XLJ8HCE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=J+8eMzorXkzCWIfi6ySXfp5WMekOt/uhQxfyAnZ6eOKuJlb1Sup/NlYdJWXpcDWYS0Nd95z8oQhUAMDZzLqtKYXI/lkNsX2kDbSuc/16KtkdgoQObv3//FBvocAN3KiglhEGn0zvbUivYmWTAAlx0MaT77bz3Q3ZzRrWTWZzrIo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.245.140]) by APP-05 (Coremail) with SMTP id zQCowAC36EKDSmBqmNW7AA--.35281S2; Wed, 22 Jul 2026 12:43:47 +0800 (CST) From: Pengpeng Hou To: Marc Kleine-Budde Cc: Vincent Mailhol , Kurt Van Dijck , Wolfgang Grandegger , "David S. Miller" , linux-can@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH] can: softing: validate firmware record spans Date: Wed, 22 Jul 2026 12:43:47 +0800 Message-ID: <20260722044347.2708-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zQCowAC36EKDSmBqmNW7AA--.35281S2 X-Coremail-Antispam: 1UD129KBjvJXoW3Xw18Xr1rtr17WrW3WF1xZrb_yoW7GFyUpa y8Xry7Xr4DKr43ur4DZw45CryUWws7C3W5Wa43ua4v9FZFvw1fA395WrW29a45Wrn3Aa17 ZFW5WF98G3W3JFDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkC14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r1I6r4UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j 6F4UM28EF7xvwVC2z280aVAFwI0_Cr1j6rxdM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwCY1x0262kKe7AKxVWU AVWUtwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14 v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkG c2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI 0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r4j6F4U MIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr1j6F4UJbIYCTnIWIevJa73UjIFyTuYvjfUejjgDU UUU X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Content-Type: text/plain; charset="utf-8" fw_parse() reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make those reads exceed the blob. The same record also supplies addresses and lengths for writes into DPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its bounds check, while the application loader does not bound the staging copy at all. Pass the firmware end to the parser and validate the full source record. Use a signed wide offset for generic DPRAM records and validate the application staging span against the mapped DPRAM before copying. Fixes: 03fd3cf5a179 ("can: add driver for Softing card") Signed-off-by: Pengpeng Hou --- drivers/net/can/softing/softing_fw.c | 46 +++++++++++++++++++--------- 1 file changed, 32 insertions(+), 14 deletions(-) diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing= /softing_fw.c index 721df91cdbfb..282570daf3ef 100644 --- a/drivers/net/can/softing/softing_fw.c +++ b/drivers/net/can/softing/softing_fw.c @@ -91,12 +91,12 @@ int softing_bootloader_command(struct softing *card, in= t16_t cmd, return ret; } =20 -static int fw_parse(const uint8_t **pmem, uint16_t *ptype, uint32_t *paddr, - uint16_t *plen, const uint8_t **pdat) +static int fw_parse(const u8 **pmem, const u8 *limit, u16 *ptype, + u32 *paddr, u16 *plen, const u8 **pdat) { uint16_t checksum[2]; - const uint8_t *mem; - const uint8_t *end; + const u8 *mem; + const u8 *record_end; =20 /* * firmware records are a binary, unaligned stream composed of: @@ -114,14 +114,21 @@ static int fw_parse(const uint8_t **pmem, uint16_t *p= type, uint32_t *paddr, * endianness & alignment. */ mem =3D *pmem; + /* A record needs an 8-byte prefix and a 2-byte checksum. */ + if (mem > limit || limit - mem < 10) + return -EINVAL; + *ptype =3D le16_to_cpup((void *)&mem[0]); *paddr =3D le32_to_cpup((void *)&mem[2]); *plen =3D le16_to_cpup((void *)&mem[6]); + if (*plen > limit - mem - 10) + return -EINVAL; + *pdat =3D &mem[8]; /* verify checksum */ - end =3D &mem[8 + *plen]; - checksum[0] =3D le16_to_cpup((void *)end); - for (checksum[1] =3D 0; mem < end; ++mem) + record_end =3D &mem[8 + *plen]; + checksum[0] =3D le16_to_cpup((void *)record_end); + for (checksum[1] =3D 0; mem < record_end; ++mem) checksum[1] +=3D *mem; if (checksum[0] !=3D checksum[1]) return -EINVAL; @@ -139,6 +146,7 @@ int softing_load_fw(const char *file, struct softing *c= ard, uint16_t type, len; uint32_t addr; uint8_t *buf =3D NULL, *new_buf; + s64 dpram_offset; int buflen =3D 0; int8_t type_end =3D 0; =20 @@ -153,7 +161,7 @@ int softing_load_fw(const char *file, struct softing *c= ard, mem =3D fw->data; end =3D &mem[fw->size]; /* look for header record */ - ret =3D fw_parse(&mem, &type, &addr, &len, &dat); + ret =3D fw_parse(&mem, end, &type, &addr, &len, &dat); if (ret < 0) goto failed; if (type !=3D 0xffff) @@ -164,7 +172,7 @@ int softing_load_fw(const char *file, struct softing *c= ard, } /* ok, we had a header */ while (mem < end) { - ret =3D fw_parse(&mem, &type, &addr, &len, &dat); + ret =3D fw_parse(&mem, end, &type, &addr, &len, &dat); if (ret < 0) goto failed; if (type =3D=3D 3) { @@ -179,9 +187,13 @@ int softing_load_fw(const char *file, struct softing *= card, goto failed; } =20 - if ((addr + len + offset) > size) + dpram_offset =3D (s64)addr + offset; + if (dpram_offset < 0 || dpram_offset > size || + len > size - dpram_offset) { + ret =3D -EINVAL; goto failed; - memcpy_toio(&dpram[addr + offset], dat, len); + } + memcpy_toio(&dpram[dpram_offset], dat, len); /* be sure to flush caches from IO space */ mb(); if (len > buflen) { @@ -195,7 +207,7 @@ int softing_load_fw(const char *file, struct softing *c= ard, buf =3D new_buf; } /* verify record data */ - memcpy_fromio(buf, &dpram[addr + offset], len); + memcpy_fromio(buf, &dpram[dpram_offset], len); if (memcmp(buf, dat, len)) { /* is not ok */ dev_alert(&card->pdev->dev, "DPRAM readback failed\n"); @@ -237,7 +249,7 @@ int softing_load_app_fw(const char *file, struct softin= g *card) mem =3D fw->data; end =3D &mem[fw->size]; /* look for header record */ - ret =3D fw_parse(&mem, &type, &addr, &len, &dat); + ret =3D fw_parse(&mem, end, &type, &addr, &len, &dat); if (ret) goto failed; ret =3D -EINVAL; @@ -253,7 +265,7 @@ int softing_load_app_fw(const char *file, struct softin= g *card) } /* ok, we had a header */ while (mem < end) { - ret =3D fw_parse(&mem, &type, &addr, &len, &dat); + ret =3D fw_parse(&mem, end, &type, &addr, &len, &dat); if (ret) goto failed; =20 @@ -279,6 +291,12 @@ int softing_load_app_fw(const char *file, struct softi= ng *card) /* work in 16bit (target) */ sum &=3D 0xffff; =20 + if (card->pdat->app.offs > card->dpram_size || + len > card->dpram_size - card->pdat->app.offs) { + ret =3D -EINVAL; + goto failed; + } + memcpy_toio(&card->dpram[card->pdat->app.offs], dat, len); iowrite32(card->pdat->app.offs + card->pdat->app.addr, &card->dpram[DPRAM_COMMAND + 2]); --=20 2.50.1 (Apple Git-155)